Seventh Circuit Court of Appeals Retroactively Enforces BIPA Damages Amendments

The Illinois Biometric Information Privacy Act (“BIPA”), discussed previously in multiple blog posts, dominated the Illinois legal landscape following a landmark Illinois Supreme Court opinion in 2019.  BIPA lawsuit filings spiked following the court’s ruling, as plaintiffs’ attorneys saw an avenue to pursue exorbitant damages. Specifically, BIPA’s damages provision provided that a prevailing party could recover $1,000 for each negligent violation of the Act and $5,000 for intentional or reckless violations. Plaintiffs’ attorneys argued that each time a defendant collected a person’s biometric information in violation of the Act, the defendant committed a new breach, thus creating a new $1,000 or $5,000 liability. In the employment context, where employers may collect employees’ biometric data multiple times per day, damages could quickly multiply.

As an example, ABC Company employs 50 people, its employees work 5 days per week, 50 weeks per year. If ABC requires its employees to use a fingerprint scanner twice per day for a five-year period, but fails to comply with BIPA during that time, ABC Company may have committed 125,000 BIPA violations. At $1,000 per violation, the defendant could face a $125,000,000 verdict. At $5,000 per violation, the defendant could be liable in the amount of $625,000,000. Not surprisingly, most defendants chose to settle BIPA lawsuits.   

In 2023, the Illinois Supreme Court seemingly endorsed this reading of BIPA in Cothron v. White Castle System, Inc. In that case, the court determined that under Sections 15(b) and (d) of BIPA, a claim accrues for each scan or transmission of biometric information made in violation of the Act. In other words, each violation of BIPA gives rise to a new cause of action and basis for damages. In the opinion, the court hinted that only the Illinois legislature could remedy the harsh, unjust, or absurd consequences of BIPA’s damages provision.

Taking the court’s hint, in 2024, the Illinois legislature passed Senate Bill 2979, which was later signed into law by Governor Pritzker. As amended, BIPA now states that a private entity that collects or discloses the same biometric identifier or information from the same person using the same method of collection in violation of Section 15(b) or (d) commits only a single violation against that person. Now, in the example above, ABC Company employees could no longer claim that the company violated BIPA each time they scanned their fingerprints. Rather, ABC Company would only face liability in the amount of $50,000 for negligent violations, or $250,000 for intentional or reckless violations.

One question that arose following the enactment of SB 2979 involved whether the amendments to BIPA applied retroactively to existing lawsuits. While SB 2979 identified the effective date of the BIPA amendments (August 2, 2024), it did not expressly state whether the amendments apply to lawsuits filed before the effective date. 

On April 1, 2026, in Clay v. Union Pacific R.R. Co., the Seventh Circuit Court of Appeals addressed this issue. In that case, the court consolidated three interlocutory appeals, noting the high financial stakes at issue. Under Illinois law, when an amendment does not expressly state whether it applies retroactively or not, courts must look to Section 4 of the Illinois Statute on Statutes. Section 4 requires courts to determine whether an amendment constitutes a procedural or substantive change in the law. Substantive changes, which prescribe the rights, duties, and obligations of persons to one another as to their conduct or property and determines when a cause of action for damages has arisen, are not applied retroactively. By contrast, procedural changes, which involve the rules that prescribe the steps for having a right or duty judicially enforced, are applied retroactively.

The court explained that, subject to certain exceptions, the Illinois Supreme Court treats remedial (i.e., damages) changes as procedural. The plaintiffs argued that the amendments were substantive changes because, prior to the amendments and pursuant to Cothron, a BIPA violation occurred every time an individual scanned his or her fingerprint in a way that violated BIPA or every time a company disseminated the same information. According to the plaintiffs, the amendments transformed thousands of violations into just one. The Seventh Circuit disagreed, explaining that Cothron did not consider the meaning of the term “violation” as used in BIPA. That term only appears in BIPA’s damages provision. Instead, Cothron addressed how claims accrue under Section 15 of BIPA.

The Seventh Circuit indicated that the Cothron court’s brief discussion of BIPA’s damages provision further supported a finding that the amendments were procedural. In Cothron, the Illinois Supreme Court invited the legislature to review policy concerns over BIPA’s damages provision and make clear its intent regarding the assessment of damages under BIPA because it was unclear whether the damages provision mandated separate damages for each violation of the Act. The Seventh Circuit viewed the BIPA amendments as the legislature’s response to the Illinois Supreme Court’s invitation in Cothron.

The Seventh Circuit also noted that in Cothron, the Illinois Supreme Court emphasized that damages under BIPA are discretionary, not mandatory. In the amendments, the legislature made clear that plaintiffs are “entitled to, at most, one recovery.” The court reasoned that if courts have discretion to decide whether to award damages at all, then BIPA plaintiffs were not guaranteed any specific recovery in the first place. Therefore, the court determined that the amendments did not alter any substantive rights or the number of injuries the plaintiffs sustained. Rather, they changed the statutory award available to the plaintiffs.